MapLibre geojson-vt: Uncontrolled recursion in nested GeometryCollection
Summary
The @maplibre/geojson-vt JavaScript library, used to slice GeoJSON into vector tiles, is vulnerable to uncontrolled recursion when it processes deeply nested GeometryCollection objects. A remote, unauthenticated attacker can send a single crafted GeoJSON payload that exhausts the Node.js call stack and terminates the process, causing a denial of service. The issue is relevant mainly for server-side tile services that accept GeoJSON from untrusted sources; browser-only use is lower risk.
Affected
- @maplibre/geojson-vt versions before 6.1.1
- Only Node.js server-side processing of untrusted GeoJSON is considered exposed by the CVE description
Fixed in
- Version 6.1.1 (fix commit cb85688, pull request #156)
Workaround
- Unknown. No vendor-documented workaround; upgrading is the recommended fix.
- Possible measures: reject or limit GeoJSON nesting depth before it reaches the library, run the service under a process supervisor that restarts it after a crash, and restrict who can submit data.
Exploitation
- Not known to be exploited in the wild.
- No public proof-of-concept found at time of research; the CVE was published on 2026-11-11.
Our recommendation
- Identify Node.js projects that use @maplibre/geojson-vt directly or through map libraries, including transitive dependencies.
- Upgrade to version 6.1.1 or the latest release and check the changelog.
- Prioritise internet-facing tile or GeoJSON processing services.
- Restrict or validate untrusted GeoJSON input and monitor for process crashes.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- GitHub Security Advisory GHSA-75qh-632x-j5pr github.com
- Release v6.1.1 github.com
- Fix commit cb85688 github.com
- Pull request #156 github.com
- CVE Record CVE-2026-58505 www.cve.org
- VulDB entry 435923 vuldb.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 20:33.
Original description (NVD)
geojson-vt is a JavaScript library for slicing GeoJSON data into vector tiles on the fly, primarily designed to enable rendering and interacting with large geospatial datasets on the browser side (without a server). Prior to version 6.1.1, @maplibre/geojson-vt contains an uncontrolled recursion vulnerability in its GeoJSON conversion logic. When a GeoJSONVT instance is constructed with a deeply nested GeometryCollection object, the mutually recursive functions featureToInternal and convertGeometryCollection in src/convert.ts exhaust the Node.js call stack, causing an unhandled RangeError: Maximum call stack size exceeded that terminates the process. Because the library is widely used in server-side tile services that accept GeoJSON over the network, a remote unauthenticated attacker can trigger a denial-of-service by sending a single crafted payload. No authentication is required, and no non-default library options are needed. This issue has been patched in version 6.1.1.
NVD references (5)
- https://github.com/maplibre/geojson-vt/commit/cb85688270d80894ce377969c75e631fe4b04c82
- https://github.com/maplibre/geojson-vt/pull/156
- https://github.com/maplibre/geojson-vt/releases/tag/v6.1.1
- https://github.com/maplibre/geojson-vt/security/advisories/GHSA-75qh-632x-j5pr
- https://github.com/maplibre/geojson-vt/security/advisories/GHSA-75qh-632x-j5pr
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.